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UNITED STATES CYBER COMMAND (USCYBERCOM) OPERATION GLADIATOR 
SHIELD (OGS) OPERATIONS ORDER (OPORD) 11-002 (S//RELTO USA, FVEY) 



(U// FOUQ ) NARRATIVE. This OPORD guides and directs the Department of Defense 
(DoD) and, as authorized, designated mission partners for cyberspace operations to 
secure, operate and defend the critical mission elements of the DoD Global Information 
Grid (DoD GIG) and represents a fundamental change in the way DoD will achieve unity 
of effort in cyberspace CDRUSCYBERCOM is the supported commander for OGS and 
all other components are supporting unless otherwise specified or directed in this order. 
OGS is foundational in both scope and purpose and is a cornerstone for achieving the 
USCYBERCOM's overall mission to plan, coordinate, integrate, synchronize, and 
conduct activities to; direct the security, operations and defense of specified DoD 
information systems and networks; and when directed, conduct full-spectrum military 
cyberspace operations in order to enable actions in all domains, ensure U.S. and allied 
freedom of action in cyberspace, and, when directed, deny the same to our adversaries 
OGS leverages the full range of capabilities, capacity and authorities of the entire DoD 
and mission partners. It clarifies the command and control (C2) relationships and 
established authorities. OGS directs cyber responses that transcend a combatant 
command AOR, establishes and directs enforcement mechanisms and streamlines 
processes to enable rapid approval and timely execution of cyberspace operations. 



1. (U//FOUO) Situation . 

a. (U//FOUG) Threats and Vulnerabilities . 
(1) (S//REL USA, FVEY)| 



(b)(1) USSC 



(b)(1) USSC 



(2) (U//FOUO) 



(b)(3) USSC 



(b)(3) USSC 
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(b)(3) USSC 




(5) (U) Actors and associated threat vectors include: 
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(a) (U) Types of Actors. Adversaries are categorized into five broad types 

based on their respective cyberspace operations capabilities and tactics, techniques 
and procedures (TTP); 

1. (U) Full Scope Actors. Actors possessing the full range of cyberspace 
access, expertise, capability, operational reach and espionage TTP. 

2 (U) Developed Program Actors. Actors with extensive access to 
information technology (IT) through industry, They possess established cyberspace 
operations programs, to include programs for disruptive and destructive actions, and 
traditional espionage capabilities. This actor type has limited resources and may lack 
global reach. 

3. (U) Capable Actors. Actors who possess traditional espionage capability 
and a developing cyberspace operations capability. They lack the resources or 
penetration of developed program actors. These actors focus on remote access, 
disruption of service and insider-enabled operations. 

4 (U) Remote Access Capable Actors. These actors can access Internet 
connected systems using openly available hacker tools but lack a traditional espionage 
capability. 



5 (U) Stand-alone Actors. Actors with access to hardware and software 
expertise who understand TTPs but exhibit little evidence of active cyberspace 
operations or traditional espionage activity. 

(b) (U) Threat Vectors. Adversaries typically employ six (6) broad threat 

vectors, independently or in some combination, to affect the security of computer 
networks These are general descriptions and any single threat may be a combination 
of several of these types 

1 (U) Insider Self-motivated, co-opted or recruited individuals with 
legitimate access to targeted information systems using those systems in un-authorized 
manners 



2. (U) Remote Network Intrusions or attacks through or on the Internet via 
other remotely available connections or access points 

3. (U) Outsourced Service. Access to information systems through 
individuals or companies contracted to provide services to the target 

4. (U) Supply Chain Subversion of the design, manufacturing and 
production, distribution, installation, or maintenance of hardware or software, to include, 
access through outsourcing services, individuals, or companies contracted to provide 
services to the target. 

5. (U) Close Access. Exploitation of information systems that requires the 
intruder to be in close proximity to the target because of security measures or isolation. 
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Close access includes the use of implanted devices as well as the collection of 
electronic emanations from the target or wireless access points. 



6. (U) Foreign Ownership. Penetration of information systems and networks 
through foreign proxies, subsidiaries, or joint ventures Closely associated with the 
insider, supply chain or outsourcing threat vectors. 



b. (U//F O UO) Friendly Forces. In order to address risks to the DoD GIG effectively 
and to secure freedom of action in cyberspace, USCYBERCOM was established by 
DoD to integrate cyberspace operations and synchronize warfighting effects across the 
global security environment, as well as. to provide support to civil authorities and 



mission partners when directed .1 



-(b)(3 ) MS SC 



(b)(3) USSC 



(1) (U// rOUO) ~ Supporting Commands . 

(a) (U//F6WO) Service Components . Those forces under the operational 
control (OPCON) of USCYBERCOM. 

(b) (U/ /FOUO ) Combatant Commands . Combatant commands build and 
maintain subordinate or supporting operational plans or associated named branch or 
sequel plans They respond to direction from USCYBERCOM for DoD GIG Operations 
and Defensive Cyberspace Operations that transcend a given combatant command. 

(2) (U//POttO) Services . Each military service provides secure, assured, and 
interoperable information systems and networks and trained personnel for the effective 
execution of military cyberspace operations. The Services ensure that Service- 
managed portions of all DoD GIG programs are planned, resourced, acquired, and 
implemented IAW DoD policies and priorities. They provide USCYBERCOM Service 
Component forces required to execute OGS cyberspace operations. 

(3) (U//FOUO) Agencies and Field Activities . All DoD agencies and field 
activities are subject to this order and USCYBERCOM direction for OGS cyberspace 
operations. Agencies and field activities ensure that agency managed portions of all 
DoD GIG programs are planned, resourced, acquired, and implemented IAW DoD 
priorities. The following agencies are specifically identified to support USCYBERCOM: 



(a) (S//REL TO USA. FVEY) 

mi 



(b)fl) / (b)(3) USSC 

/ (b)(3) USSC 
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(b)(1) /(b)(3) USSC 



(b) (U//FOUO) The Defense Information Systems Agency (PISA). DISA 
supports OGS by engineering and providing C2 capabilities and enterprise 
infrastructure to continuously operate and assure a global enterprise for the DiSA 
elements of the DoD GIG providing direct support to joint warfighters, national-level 
leaders, and other mission partners across the full spectrum of operations. 



(CKU//FOUO) 


fbl/31 USSC 




(b)(3) USSC 



(4) (U/ /FOUO) Law Enforcement/Counterintelligence (LE/CO . The LE/CI 
community, while not wholly within DoD, contributes to OGS by providing timely 
actionable intelligence in support of current operations. LE/CI identifies the linkages 
between insider and other threats to the DoD GIG. USCYBERCOM will share 
information and intelligence, and assist the LE/CI community as requested or directed. 

(5) (U/ /FOU 6) Other non-DoD agencies 

(a) (U) Other U.S. Government Agencies. Other U S. Government Agencies 

may have access to the DoD GIG and DoD GIG resources to include the DHS. DoJ, 
DoS, DoE, OMD, WHS, and FBI. USCYBERCOM, ICW DISA. will coordinate with non- 
DoD agencies for the security of those portions of the DoD GIG accessed or used by 
those. 



(b) (S//REL TO USA, FVEY) 



(bim USSC 



(b)(1) USSC 



c. (U// FOUO) Area of Concern 

(1) (U//FGUO) Area of Responsibility (APR) . The AOR for OGS is the DoD GIG. 

(2) (U//FOUG) Area of Operations (AO') . The AO for OGS is global with effects 
manifesting in the DoD GIG and with other portions of cyberspace accessed, as 
authorized, to achieve OGS objectives. The DoD GIG is the globally interconnected. 
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end-to-end set of information capabilities for collecting, processing, storing, 
disseminating, and managing on-demand information to warfighters, policy makers, and 
support personnel. The DoD GIG includes owned and leased communications and 
computing systems and services, software, data, security services, related services, 
and select networks of the National Security Systems (NSS). 

(3) (U//FQUO) Area of Interest (API). For OGS, the AOI is global and is 
represented by the information environment comprised of physical, informational, 
spectral and cognitive dimensions and its cyberspace intersections with the air, land, 
maritime and space domains. 



d. (S//REL TO USA. FVEYll 



(biMHJSSC 



(b)(1) USSC 



2. (S//REL TO USA, FVEY) 



(b)(1) USSC 



(b)(1) USSC 



3. (U) Execution. 









(b)(1) USSC 




(b)(1) USSC 









(3) (U//FGU0)- Operational Objectives 



S//REL TO USA, FVEY) \ 



(b)(1)*USSC 




(d) (U/ / F QU 0 ) All DoD Components are in, and sustain, compliance with 

established DoD GIG standards. 



S//REL TO USA, FVEY) 



b)(1) USSC 




(b){1) USSC 




(f) (U//F Q U O) Key partner nations and organizations are enabled to 
coordinate, synchronize and, as required and authorized, execute DoD GIG Operations 
and Defensive Cyberspace Operations with USCYBERCOM to achieve OGS objectives 
and intent 



S//REL TO USA. FVEY 



1) USS 
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(4) (U//FOOO) End States. 

{a) (U//FOU0) The DoD GIG is persistently secured, operated and defended 

with mission-criticaf elements given priority of effort. 

(b) (U//FOUO) Freedom of action in cyberspace for DoD and mission 
partners is assured. 

(c) (U/i'FStJ©) Adversaries are deterred from attacking or exploiting the DoD 



(d) (U//FOUO) DoD GIG Operations and Defensive Cyberspace Operations 
capabilities and capacity to secure, operate and defend the DoD GIG are fielded and 
available for employment. 
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(e) (U//F0U©) (U//F QUG } Defense Support to Civil Authorities (DSCA) is 

conducted when directed. 

b. (U//FOWO) Tasks. Refer to Annexes for additional tasks 
(1) (U) Tasks to all DoD Components. 

(a) (U/ /FOUe>) -Plan and execute DoD GIG Operations, Defensive 
Cyberspace Operations and related support activities to clear, hold and build a secure 
and defensible DoD GIG. Maintain and report compliance with USCYBERCOM orders 
and directives. 

(b) (U//FOUQ) Comply with all USCYBERCOM policies and orders. Respond 
to reporting requirements from USCYBERCOM J3. 

(c) (U//F 0U 9) Provide situational awareness data to USCYBERCOM J3. 

(d) (U//P OUG -) Coordinate and collaborate on cyberspace equities 

(e) (U/ /rOUQ ) Collaborate to define and refine requirements that build a 
more secure and defensible DoD GIG. 

(f) (U//FOUO) Comply with DoD IA standards. 

(g) (U// FQUQ) Comply with DoD equipment accountability standards and 
procedures 

(h) (UtfFQUO) Develop and implement OPSEC plans ISO OGS. 

(i) (U//F Q UQ) Provide USCYBERCOM J3 a list of mission-critical elements 
(systems, networks and nodes) on or connected to the DoD GIG. 

(j) (U//F0WO) Implement Information Condition (INFOCON), or Cyber 
Condition (CYBERCON) when approved, and report compliance to the USCYBERCOM 
Joint Operations Center (JOC). 

(k) (U//FGWO) ICW USCYBERCOM J3, develop and implement DoD GIG 
Operations and Defensive Cyberspace Operations assessment program. 

(l) (U//FOU0) Implement USCYBERCOM-directed Cyber Security 
Inspection Program and provide reporting criteria to USCYBERCOM for DoD-wide 
assessments. 

(m) (U//F OU O) Provide reporting as directed in the Annexes. 

(n) (U// FOU Q) ICW USCYBERCOM J8, program and budget for forces 
assigned or OPCON to USCYBERCOM. Provide USCYBERCOM J8 with Planning. 
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Programming, Budgeting and Execution (PPBES) documents, Service programs and 
PPBES issues impacting DoD GIG Operations and Defensive Cyberspace Operations. 

(2) (U) Tasks to HQ, USCYBERCOM. 

(a) (U) JO. Develop and maintain currency of Annex F (Public Affairs), Annex 
Y (Strategic Communications) and Appendix 9 (Legal) to Annex C (Operations). 

(b) (U) J1 

1 (U//FOUG) ICW USSTRATCOM J 1 , coordinate with the Services to 
ensure that qualified military and civilian personnel are assigned and recruited for DoD 
GIG Operations and Defensive Cyberspace Operations 

2. (U//FOUO) Provide plans, policies and guidance for personnel readiness 
issues that support execution of OGS. 

3. (U//F©yO) ICW USSTRATCOM J1, identify skill sets, training and 
readiness metrics for forces in support of OGS. 

4. (U//FGUO) Develop and maintain Annex E (Personnel). Coordinate input 
from J8 for Appendix 3 (Finance and Disbursing). 

(c) (U) J2 

1 . (U// FOUO ) Conduct Operational Preparation of the Environment (OPE) 
ISO OGS within the limits of USCYBERCOM’s delegated authorities 

2. (U//F©yQ) Conduct continuous intelligence operations, including post- 
event assessments, ISO OGS. 

3. (U/ /FOUO ) Through the Joint Intelligence Operations Center (JIOC), 
ensure the availability of all sources of intelligence information from Combatant 
Command and national intelligence resources. 

4. (U// FOUO ) Coordinate, synchronize and integrate intelligence into 
operational plans and DoD GIG Operations and Defensive Cyberspace Operations 
execution. Engage actively with the 1C. 

5. (U// FOUO) Provide a quarterly threat update to all DoD Components and 
authorized mission partners highlighting current and emerging threats 

6. (U// FOU O) ICW DIA and the 1C, develop, implement and maintain an 
intelligence architecture to support USCYBERCOM operations. 

7. U//F©y©) Develop and maintain Annex B (Intelligence). 

(d) (U) J3 
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1 . (U//f©ttO) Command and control DoD GIG Operations and Defensive 
Cyberspace Operations to achieve OGS objectives and desired end states 

2. (U//F OUQ) Lead development and direct implementation of DoD GIG 

monitoring. 

3. (U//-FG0©) Direct, coordinate, synchronize and deconflict Defensive 
Cyberspace Operations in order to achieve unity of effort to clear adversary presence 
and vulnerabilities on the DoD GIG in priority of mission criticality 

4. (U//F©yO) Direct, coordinate and synchronize actions to hold secure the 
DoD GIG from adversary intrusion or attack with priority on the mission-critical 
elements. 



5. (U//FGU0) ICW USSTRATCOM, define or update criteria and implement 
procedures for changes to INFOCON, or when approved, CYBERCON. 

6. (U//F0U0) Lead development of, and issue, necessary orders to 
accomplish OGS objectives. 

7. (U/ /FQUQ ) Lead development and direct the implementation of reporting 
and analysis processes for DoD GIG Operations and Defensive Cyberspace 
Operations. 



8. (U//F0U0) Lead the development, coordination and synchronization of 
options to establish and maintain cyberspace superiority to hold secure the DoD GIG 
Direct implementation as appropriate with priority to mission-critical elements 

9. (U// f~ - 6U6 ) Establish and implement procedures for the conduct of risk 
assessments related to DoD GIG Operations and Defensive Cyberspace Operations 

10. (U//FOUO) Establish and implement a process to assess Tactics. 
Techniques and Procedures (TTP) for DoD GIG Operations and Defensive Cyberspace 
Operations. 



11. (U//F0U0) ICW USSTRATCOM and USNORTHCOM, establish a 
DoD process for responding to national-level cyber incidents. 

12. (U//F0U0) Develop and implement a comprehensive program for 
assessing DoD components’ DoD GIG Operations and Defensive Cyberspace 
Operations effectiveness and provide recurring feedback to DoD components on their 
status. 



13. (U//F0U0) Establish and maintain an effective Cyber Security 
Inspection Program. 
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14, (U//F©yO) Establish and implement governance of the DoD GIG that 
specifies compliance requirements, establishes security standards, sets service delivery 
standards and enforcement processes and procedures. 

15, (U//FOUO) Establish cyberspace SA information requirements, 
reporting procedures and technology baseline necessary to provide near real time SA. 
Implement and promulgate to all DoD Components and designated mission partners. 
Disseminate global DoD GIG Operations and Defensive Cyberspace Operations SA. 

16, (U//F0tt0) Establish a process to identify mission-critical elements of 
the DoD GIG. Maintain an active and current database. 

17, (U//F©t)0) Establish criteria and technology baseline and implement 
Indications and Warning (l&W) processes and procedures 

18, (U//F OUQ ) Establish and lead Joint Operational Planning Teams 
(OPT) in order to support future DoD GIG Operations and Defensive Cyberspace 
Operations. 



19. (U// F QUQ) Implement procedures and direct the operational 
configuration of DoD capabilities to achieve unity of effort ISO OGS. 

20. (U/ /FOUO ) Plan, implement and direct execution of DNDO, to include 
establishing Pre-approved Actions (PAA) through the use of deliberate orders 
processes, which enable rapid action to clear vulnerabilities and adversary presence on 
the DoD GIG. The priority for DNDO will be on mission-critical elements of the DoD 
GIG Ensure deconfliction, coordination and synchronization across DoD and with 
mission partners having equities in any given action. 

21 . (U //rO bO) Develop and implement a more rapid and comprehensive 
early warning capability of adversary threat activities against the DoD GIG. 

22. (U//F0tfO) Provide geolocation and characterization of SATCOM 
interference: develop and promulgate TTP to resolve SATCOM interference. 

23 (U//F©b6) ICW USSTRATCOM, NSA and DISA, develop and deploy 

shared or peer-to-peer sensors to monitor and detect adversary cyber capabilities and 
methods. 



24. (U//F©y©) Plan, organize and deploy Cyber Support Elements 
{CSEs), to include Expeditionary Cyber Support Elements (ExCSEs), and other 
adaptive cyber organizations to the Combatant Commands to support planning and 
operations and improve SA. 

25. (U//F0WQ) On order of the SecDef and after completing the required 
inter-agency deconfliction, direct Defensive Cyberspace Operations beyond the 
boundary of the DoD GIG. Coordinate, synchronize and deconflict with other DoD and 
authorized mission partners, as appropriate. 
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26 (U//F0UO) Develop and maintain the currency of the OGS Base Order 

and Annex A (Task Organization), Annex C (Operations), Annex J (Command 
Relationships), Annex R (Reports), Annex S (Special Technical Operations (STO)) and 
Annex Z (Distribution). Consolidate all Annexes with the Base Order. Disseminate to 
the DoD and authorized mission partners, 

27. (U) Develop and implement a cyberspace synchronization process. 
Host a global synchronization conference at least annually and address coordination 
across DoD components and the U.S Coast Guard. 

(e) (U) J4 

1 (U//F QU 0) Plan, coordinate, direct and execute logistics and sustainment 
functions ISO OGS. 

2 (U// FOUO) Develop and maintain Annex D (Logistics and Sustainment) 

(f) (U) J5 

1. (U/ ZTOUQ ) Develop, and update as required, a cyberspace campaign 
plan for cyberspace operations. 

2. (U/ /FOUO ) Support current and future operations planning as subject 
matter experts for supported Combatant Command contingency plan execution 

3 (U//F0UO) Lead development of future plans to accomplish OGS 

objectives 

4. (U//F0U0) ICW USSTRATCOM and USCYBERCOM J8, advocate for 
future capabilities and capacity to achieve OGS objectives. Establish and maintain the 
Cyber Capabilities Registry (CCR) ICW DoD Components and mission partners 

5 (U// TOUO ) ICW USSTRATCOM, assess policy and doctrine related to 
OGS and recommend changes or new policy and doctrine supportive of full 
achievement of OGS intent and objectives. 

6 U//F0U0) ICW USSTRATCOM. ensure future plans are supportive of 
OGS end states and objectives. 

7 U//F QU Q) Develop and maintain Annex O (Advocacy). Annex V (Mission 
Partner Coordination) and Annex W (Acronyms, Glossary, References). 

(g) (U) J6 

1 U/ /FOU Q) Adjudicate security issues associated with connections on the 
DoD GIG. Coordinate adjudication with USCYBERCOM J3 and affected organization 
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2. (U/ / F OUQ ) Advise and assist USCYBERCOM J3 with planning and 
execution of DoD GIG Operations and Defensive Cyberspace Operations. 

3. (U//F QU 6) Develop and implement network configurations to facilitate 
DoD GIG Operations and hold secure the DoD GIG. 

4. (U//F OUO) ICW DISA and NSA, plan, develop, implement and integrate 
critical communications systems and services to support DoD GIG Operations and 
Defensive Cyberspace Operations. 

5. U//FOBO) ICW DISA and USCYBERCOM J1 , J3 and J7, develop a user 
certification process and set of Information Assurance (IA) standards for baseline 
competency for authorized users on the DoD GIG. 

6. U//F0U0) Provide technical assistance and expertise to assure timely 
and accurate situational awareness and GIG monitoring capabilities to the 
USCYBERCOM J3 JOC. 



7. (U/ /FOUQ ) Develop and maintain Annex K (Command, Control. 
Communications and Computing (C4)). 



(h) (U) J7 

1. U/ /FQUO) ICW USJFCOM, develop, sponsor and conduct periodic joint 
training and exercises to assess DoD GIG Operations and Defensive Cyberspace 
Operations procedures, capabilities, effects, personnel training proficiency and TTP. 



2 (U//FGU©} ICW J1, J3 and J6, develop a master training program to 
sustain and enhance the proficiency of personnel engaged in DoD GIG Operations and 
Defensive Cyberspace Operations. 



3. (S//REL TO USA, FVEY) 



(b)(1jUSSC_ 



(b)(1) USSC 



4. (U/ /F0U 6 ) Establish and implement a lessons learned process to capture 
results, best practices and practices to avoid. 

5. (U/ /rOUO ) Develop and maintain Annex U (Exercises and Training). 

(i) (U) J8 

1. (U//FOU O) ICW USSTRATCOM, develop and implement a process to 
present OGS resource requirements in the POM cycle. 

2. (U//F OUQ ) Perform resource management ISO OGS. 
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3. (U//Feue) ICW J5 and J3, advocate for resources ISO OGS. 

4. (U//FOW6) Publish and maintain Appendix 3 (Finance and Disbursing) to 
Annex E (Personnel) to OGS 

(3) (U) Tasks to USCYBERCOM Service Components. 

(a) (U) Tasks to all USCYBERCOM Service Components. 

1. (U//FOW©) Respond to direction from USCYBERCOM for planning and 
execution of DoD GIG Operations and Defensive Cyberspace Operations that secure, 
operate and defend the DoD GIG with priority of effort on mission-critical elements. 

2. (U//F OUO) Coordinate with USCYBERCOM J3 for mission priorities, 
requirements and capabilities. 

3. (U// T - QUQ ) Develop and maintain subordinate or supporting operational 
plans and orders ISO USCYBERCOM OGS or associated branch or sequel plans and 
orders. 



4. (U//FOttO) Maintain proficiency of, administer, support and report 
readiness of Service forces delegated as OPCON from USCYBERCOM. 

5. (U/ /FOUO) If authorized to conduct such activities, conduct or support 
intelligence activities as directed. 

6 (U//P©tt©) ICW USCYBERCOM J1, coordinate with the Services to 
ensure that qualified military and civilian personnel are assigned and recruited for DoD 
GIG Operations and Defensive Cyberspace Operations. 

7 (U// rOUQ ) ICW USCYBERCOM J3, facilitate the presentation of Service 
cyber forces for DoD GIG Operations and Defensive Cyberspace Operations and 
leverage Sen/ice capabilities and capacity. 

8. (U//F QUQ ) Provide expeditionary forces as directed. 

9. (U//F0U0) Assist USCYBERCOM, as requested, with operational 
planning, to include identifying forces, capabilities, logistics requirements and other 
related planning factors. 

10. (U/ /FOUO ) On order, assist in the establishment of a Joint Task Force 
(JTF) headquarters and, as available, deploy C2 systems to support the JTF. 

1 1 . (U//F QUQ ) ICW USCYBERCOM J33, provide SA and performance 
data of current cyber operations. 

12 (U//F Q U Q ) When supporting a Combatant Command, and ICW 
USCYBERCOM J3, coordinate for approval of Theatre-based cyber actions. 



19 

SE CRET//RELTO USA. FVEY 




SCCRET//REL TO USA, FVGY 



(b) (U) U S. Air Force Cyber Command/24 th AF (AFCYBER). Refer to 
Annexes for tasks specifically assigned and implied. 

(c) {U) U S Army Cyber Command /2d Army (ARCYBER). Refer to Annexes 
for tasks specifically assigned and implied 

(d) (U) U S. Fleet Cyber Command/1 0 th Fleet (FLTCYBERCOM). Refer to 
Annexes for tasks specifically assigned and implied. 

(e) (U) U S. Marine Forces Cyber (MARFORCYBER) Refer to Annexes for 
tasks specifically assigned and implied. 

(4) (U) Tasks to Combatant Commands 

(a) (U/ /rOU O) Respond to direction from USCYBERCOM for planning and 
execution of DoD GIG Operations and Defensive Cyberspace Operations that 
transcend a Combatant Command’s AOR. 

(b) (U//F QU Q) Develop and maintain subordinate or supporting operational 
plans and orders ISO USCYBERCOM OGS or associated branch or sequel plans and 
orders 

(c) (U//F OUQ ) Collaborate with USCYBERCOM to facilitate coordination 
and deconfliction of DoD GIG Operations and Defensive Cyberspace Operations 

(d) (U/ /FOUO ) Integrate DoD GIG Operations and Defensive Cyberspace 
Operations into contingency plans. 

(e) (U//F OU 6) Accept CSEs and LNOs and integrate into operational and 
intelligence flow. 

(5) (U) Tasks to Services. 

(a) (U//FOU0) Support OGS by providing secure, assured and interoperable 
information systems and networks and ensuring that pertinent information is shared with 
USCYBERCOM 

(b) (U//F OUQ ) Provide organized, trained and equipped forces to 
USCYBERCOM, through USSTRATCOM 

(c) (U//F©UG) ICW USCYBERCOM, ensure that Sen/ice-managed portions of 
all DoD GIG programs are planned, resourced, acquired and implemented to support 
attainment of OGS end states and objectives. 

(d) (U// rOUO ) As requested, support USCYBERCOM planning and 
execution of DoD GIG Operations and Defensive Cyberspace Operations. 
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(e) (U//F©b0) ICW USCYBERCOM, develop and maintain DoD GIG 
Operations and Defensive Cyberspace Operations capabilities for implementation ISO 
OGS. 

(f) (U//FOttO) Support USCYBERCOM with assessment of DoD GIG 
standards compliance. 

(g) (U//FOUO) Comply with standards to clear, hold and build a secure and 
defensible DoD GIG. 

(h) (U//F0UO) Provide shared SA of Service-operated portions of the DoD 
GIG to USCYBERCOM to support DoD GIG Operations and Defensive Cyberspace 
Operations. 

(i) (U/ /FOU Q) ICW USSTRATCOM, provide Intelligence, Surveillance and 
Reconnaissance (ISR) forces and intelligence to USCYBERCOM J2. 

(j) (U//E OUO ) USSOCOM will comply with Service tasks with the exclusion of 
providing organized, trained, and equipped forces. 

(6) (U) Tasks to DoD Agencies and Field Activities. 

(a) (U) Tasks to all DoD Agencies and Field Activities. 

1. (U//FQUQ) ICW USCYBERCOM, ensure that agency-managed and field 
activity-managed portions of all DoD GIG programs are planned, resourced, acquired 
and implemented to support attainment of OGS end states and objectives 

2. (U//F QUQ ) As directed, support USCYBERCOM planning and execution 
of DoD GIG Operations and Defensive Cyberspace Operations. 

3. (U//FOU©) Respond to direction from USCYBERCOM for planning and 
execution of DoD GIG Operations and Defensive Cyberspace Operations. 

4 (U//FOUO) ICW USCYBERCOM J33, provide situational awareness and 
performance data of current and plan cyber operations for assigned portions of the GIG 
to support DoD GIG Operations and Defensive Cyberspace Operations 



(b) (U) National Security Agency (NSA). 
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b)(1) USSC 


(b)(1) USSC 





(c) (U) Defense Information Systems Agency (DISA). 



1. (U//F0UO) Provide engineering, C2 capabilities and enterprise 
infrastructure ISO OGS. 

2. (U// TOUQ ) Provide direct support to USCYBERCOM for DoD GIG 
Operations and Defensive Cyberspace Operations. 



(d) (U) Defense Intelligence Agency (DIA). 



1 . (U//FOUO)r 


(b)(3) USSC 


(b)(3) USSC 


? m//Fouo) 


(b)(3) USSC 


| (b)(3) USSC 


3 ruz/FonoiT 


fhV31 USSC 




(b)(3) USSC 



(e) (U) Law Enforcement and Counterintelligence (LE/CI). 



1 . (U/ /FOU Q) Provide timely actionable intelligence in support of DoD GIG 
Operations and Defensive Cyberspace Operations, to include identifying the linkages 
between insider and other threats. 

2. (U//FOU©) Provide intelligence systems support, funding, personnel and 
training ISO OGS. 

3. (U//F O U0) Synchronize investigative actions related to malicious activity 
against the DoD GIG among Department of Defense law enforcement and 
counterintelligence investigative organizations. 

c. (U//FOWG) Coordinating Instructions 

(1) (U//F QUQ) This OPORD is effective upon receipt for planning and 
execution. 

(2) (U//F QU O) Direct Liaison Authorized (DIRLAUTH) as required to fulfill OGS 
mission requirements. Maintain close coordination with USCYBERCOM and supported 
commands. Coordination with partner nations must be accomplished through 
USCYBERCOM, ICW the supported command, USSTRATCOM and the Joint Staff 
{JS), and following appropriate foreign disclosure and information sharing regulations 
and policies, as well as, existing memorandums of agreement or understanding. 
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(3) (U// FQUQ ) For actions associated with OGS, the rules of engagement are 
per Ref d 

(4) (U/ /rOUO ) To the maximum extent possible use the Joint Operations 
Planning and Execution System (JOPES) to facilitate planning. 

(5) (U//FOUO) Routine rotation of forces is authorized, as coordinated with the 
supported command. 

(6) (U/ /rOUO) Operational reporting will be in accordance with published 
annexes to this OPORD and occur via DoD component operational channels to the 
USCYBERCOM JOC while providing SA to the affected DoD component or mission 
partner. 

(7) (U//F QUO ) DoD components that desire to achieve effects that exceed 
authorities or capabilities, or are not otherwise addressed in existing plans or orders, will 
contact the USCYBERCOM J3 for direction and guidance. 

(8) (U//F©y©) DoD GIG Operations and Defensive Cyberspace Operations 
affecting 1C networks under authority of the Director of National Intelligence (DNI) and 
all networks that process sensitive compartmented information (SCI) will be executed in 
accordance with joint procedures defined by the Secretary of Defense (SecDef) and the 
DNI or their designees. 

(9) (U/ZF0ti0) Submit any recommended updates to this OPORD, its annexes, 
or appendixes to USCYBERCOM J3 

(10) (U// F0U 6) USCYBERCOM OPORD 05-01 (formerly Joint Task Force- 
Global Network Operations (JTF-GNO)) is superseded by this order. 

(11) (U// POUQ ) A standard set of metrics and measurements, developed and 
promulgated by USCYBERCOM, will be used to assess DoD GIG operating 
performance, determine the mission impact of service degradations or outages, and 
assess the effectiveness of Defensive Cyberspace Operations capabilities, to include, 
sensors and systems to counter threats and vulnerabilities 

4. (U) Administration and Logistics. 

a. (U//F OUQ ) Funding. DoD components will fund all costs of operations required or 
incurred as a result of OGS, including deployment and redeployment of personnel or 
units USCYBERCOM Service Components will track and report all incremental costs 
incurred ISO this order to USCYBERCOM J8. Refer to Annex O for further guidance, 
tasks and requirements 

b. (U//F OUO ) Logistics and Sustainment. Refer to Annex D for further guidance, 
tasks and requirements. 



23 

0ECRCT//RCL TO USA, TVEY - 




SECRCT//REL TO USA, TVCY 



(1) (U/ /FOUQ ) All DoD components and supporting mission partners will 
conduct sustainment activities to ensure uninterrupted conduct of OGS. 

(2) (U/ /FQUQ ) While it is anticipated that the majority of cyberspace operations 
forces would not physically deploy to accomplish OGS tasks, if deployment is necessary 
all USCYBERCOM Service Components will coordinate with the USCYBERCOM J4. 

c. Personnel Refer to Annex E for further guidance, tasks and requirements 

(1 ) (U//F OU O) Concept of Personnel Support. Prior to and during OGS, 
components will receive the majority of routine personnel support through their home 
station and parent unit, J1 monitors component personnel operations and provides 
assistance, as required 

(2) (U//F0UO) Strength Reporting, USCYBERCOM J1 provides the Joint 
Personnel Status (JPERSTAT) to Joint Staff J 1 , USSTRATCOM J1 and 
USCYBERCOM leadership as directed. All components that are under the Operational 
Control (OPCON) of CDRUSCYBERCOM will submit the JPERSTAT to 
USCYBERCOM J1 daily by 1600Z. The JPERSTAT Report is to be classified SECRET 
and the primary transmission method shall be via secure email. Reports shall be 
formatted in accordance with CJCSM 31 50.1 3C. 

d. (U//F QUO) Public Affairs (PA). Refer to Annex F for further guidance, tasks and 
requirements, 

(1) (U//F0UO) The PA posture for OGS is passive, respond to query only. 
USCYBERCOM Service Components will coordinate and synchronize PA products with 
USCYBERCOM PAO prior to release. 

(2) (U// FOUQ ) In the event that information regarding a specific defensive 
cyberspace operation is disclosed, the following statement is authorized after proper 
notification to USCYBERCOM PAO: “The Department of Defense depends on 
cyberspace for critical military capabilities and must be able to secure, operate and 
defend DoD networks. The Department has more than 15.000 networks and 7 million 
computing devices that are vital to our operations. The Department’s strategy requires 
the full range of capabilities to defend against a variety of threats and to protect our 
networks." 

e. (U//F0UO) Strategic Communication (SC). USCYBERCOM Service 
Components will coordinate and synchronize OGS-related SC themes and messages 
with USCYBERCOM SC prior to release. Refer to Annex Y for further guidance, tasks 
and requirements. 



5. (U) Command and Control. 
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f. (U//FOUQ) All communications regarding OGS will be by appropriately secured 
means, and with full adherence to OPSEC requirements, 

g. (U//F©y©) DoD GIG Operations and Defensive Cyberspace Operations data will 
be shared and exchanged through common interoperable standards in accordance with 
DoD data sharing policies and guidance 



25 

- S C CR C T//nCLTe - USA, HVEr 








SECR C T/yRCL - TO USA, FVEY 



h. (U//F OUO ) (U//F OUO ) Standard orders formats (OPORD, Fragmentary Order 
(FRAGO), Warning Order (WARNORD) and Plan Order (PLANORD)) will be used to 
issue operational direction to secure, operate and defend the DoD GIG and for any 
other cyberspace operation when directed. Information dissemination formats will be 
limited to Cyber Daily Reports, Situation Awareness Bulletins, J2 Cyber Alerts and 
Intelligence Summaries. Methods of dissemination will remain unchanged. Refer to 
Appendix 23 (Orders and Reports) to Annex C for further guidance and direction. 

i. (U//F QUQ) In the event USCYBERCOM is unable to operate from its facilities at 
Fort George G. Meade, C2 will be executed per USCYBERCOM Continuity of 
Operations (COOP) Plan. 



General, USA 
Commanding 
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Annexes 

A - Task Organization 
B - Intelligence 
C - Operations 

D - Logistics and Sustainment 
E - Personnel 
F - Public Affairs 
G - Civil Affairs (omitted) 

H - Meteorological and Oceanographic (omitted) 

I -Not Used 

J - Command Relationships 

K - Command Control, Communications, and Computer (C4) Systems 
L - Environmental Considerations (omitted) 

M - Geospatial Information and Services (omitted) 

N - Space Operations (omitted) 

O - Advocacy 

P - Host Nation Support (omitted) 

Q - Medical Services (omitted) 

R - Reports 

S - Special Technical Operations (STO) 

T - Consequence Management (omitted) 

U - Exercises and Training 

V - Mission Partner Coordination 
W- Acronyms, Glossary, References 
X - Execution Checklist (omitted) 

Y - Strategic Communications 
Z - Distribution 



28 

S E-CRCT//RCL TO USA, FVEY 




Subject: (U// TOUO ' OPORD 12- 101b HOST BASED SECURITY SYSTEM ; HBSS1 

DEPLOYMENT AND OPERATIONS' 



Originator: USCYBERCOM SC) 

DTG: 212131Z Aug 12 
Precedence: ROUTINE 
DAC: General 

To: AFOG AFWATCH (SC) , AFRICOM CDR'MC), AFRICOM JOC CHIEF, MC), CDS NORADtSC), 
CDR USCSNTCOM(MC) , CDR USPACOM HONOI.LT.U HI{SC), CDR USSOCOM(KC), CDR 
USSOUTHCOM(MC) , CDR USSTRATCOM < SC } , CMD CTR USSTRATCOM ,'SC) , CMC WASHINGTON 
DC (SO), CNO WASHINGTON DC (SC), COMDT COGARL' WASHINGTON DC, DA HO DA 
SECRETARIAT ! SC) , EUCOM EPOC JOC (MC), EUCOM CDR(KC), HQ AFRICOM (MC), HQ USAF 
CC ISC), HQ USPACOM JOC (SC), HQ USPACOM ( SC) , HQ IJSSOUTHGOM (MG) , HQ 
USSTRATCOM { SC ) , N-NC CMD CENTER (SC) , USCENTCOM COMMAND CENTER (MC) , BTA 
ARLINGTON VA(SC), DARPA ARLINGTON VA(MC), DECA HQ(SC), TEAS CLEVELAND CHiSC), 
DISA DCC(SC), DISA DIRECTOR (SC) , DSCA OPS (SC), DNI WATCH, DSS WASHINGTON DC, 
DTRA OPSCENTER WASHINGTON DC, !!Q DCMA.SC), HQ DLA FORT 3SLV01R VA'SC), MDA 
OPERATIONS CENTER (HOC) (SC) , NRO WASHINGTON DC, TMA FALLS CHURCH VA, USUHS 
BSTHESDA MD(SC), DIA WASHINGTON DC, EISA WASHINGTON DC(SC), DNI WASHINGTON 
DC, DNI WATCH WASHINGTON DC, NSACSS FT GEORGE G MEADE MD, NSACSS SAN ANTONIO 
TX, OSD CIO- PENTAGON CIO (SC), ?4AFA3(SC), 24A? CC(SC), 62*100 CC (SC) , ARCYBEF 
WATCH OFFICER !MC), ARCYBER CDR (SC), ARCYBER G3!SC), ARCYBFR G33IMC), 

COM! LTCYBERCOM FT GFORGE G MEADS MD(SC) , COMNAVCYBERFOR VIRGINIA BEACH 
VA(SC), MARFOHCYBERCOM FT MEADF MD(SC), COG ART CTRT ALEXANDRIA VA, COGARD 
CYBERCOM WASHINGTON DC 

cc: OSD WASHINGTON DC, DFPT OF COMMERCE WASHINGTON DC, DERT OF ENERGY 
WASHINGTON DC, DEPT OF HOMELAND SECURITY WASHINGTON DC, DEPT OF JUSTICE 
WASHINGTON DC, DFPT OF STATE WASHINGTON DC, NAVCYBERDEFCPSCOM VIRGINIA BEACH 
VA ( SC! , rEMA HQ WASHINGTON DC, NMCC WASHINGTON DC, 3SCDEF 'WASHINGTON DC, 
USCYBFRCOM FT GEORGE G MEADE MD 




REF/A/OPORD/USCYBERCOM/19MAYll/(U//=eee> OPERATION GLADIATOR SHIELD IOGS) 
OPERATIONS ORDER (OPORL) 11-002 (S//REL TO USA, FVEY) / / 

RFF/B/DOC (’J) FRAGO 13 TO JTF-GNO OPORD 05-01 REQUIREMENTS FOR RAPID 
DEPLOYMENT OF BBSS ON SJPRNF.7 AND UNCLASSIFIED NETWORKS/26 MOV C8//!S//REL TO 
USA, FVEY)// REF/C/DOC (U) IJSCYBERCOM CTO 10-080 HOST BASED SECURITY SYSTEM 
BASELINE UPDATES FOR MAINTENANCE RELEASE 5 I MRS ) / ( U / / FOUO ) / / 

RSF/O/SIPRNSI* URL(S) HTTEC: »•,*. . " VCZl ?■ . S'U IP ■ - .AS! - ■ 

REF/E/NI PRNFT URT.(U) HTTPS :/ /PATCHES .MONT . DISA. MIL/ / 

REF/F/SIPRNET URL((I) TPT : / / ^ - NT- . ITT.- . -TL L ■ Ml L 

REF/G/DOC(U) CHAIRMAN OF THE JOINT CHIEFS OF STAFF MANUAL 6510. 01A INFORMATION 
ASSURANCE IA] AND COMPUTER NETWORK DEFENSE !CND) VOLUME I (INCIDENT HANDLING 
FROGRAMt/24 JUN 09// 

F.EF/H/COCtU) CHAIRMAN OF THE JOINT CHIEFS OF STAFF INSTRUCTION 6510. 01E 
INFORMATION ASSURANCE ( IAJ AND COMPUTER NETWORK DEFENSE (CNDJ/D9 FEB II// 

REF/ 1 / DOC ( r J) DOD DIRECTIVE 0-8530.1 COMPUTER NETWORK DEFENSE ( CNDl /08 JAN 
01// ( IJ / / FCUO ) / / 

REF/J/DOC <U) USCYBERCOM CTO 10-Ui COMMUNICATIONS TASKING ORDFR (CTO) 10-133 
PROTECTION OF CLASSIFIED INFORMATION ON DEPARTMENT OF DEFENSE (DOD) SECRET 
INTERNET PROTOCOL ROUTER NETWORK JSIFRNET) 




3. A. fUZ/ 'TOUQ ) COMMANDER'S INTENT.// 



3.A.I. < 0/ / roue PURPOSE. THE FFPI OYMENT , EMPLOYMENT, REPORTING, ANALYSIS, 

AND 

OPERAT IONAL USE OF HBSS FOP. DEFENSE Or THE LX>U GIG.// 

3. A.?. ! U / / -FOUO .' METHOD. USOYBSRCCM WILL DIRECT DEFENSIVE ACTIONS AND 

MANEUVER 70 DENY THE ADVERSARY A FOOTHOLD ON THE DOD GIG. THE DOD REQUIRES 
POSUS !’, ADAPTIVE, AND AGILE PROTECTION OF ITS INFORMATION SYSTEMS. HBS" 
PROVIDES A CRITICAL. LAYER OF THE DEFENSE- IN-DEPTH OF THE GIG, AND IS ABLE TO 
DETECT, PREVENT, AND/OR MITIGATE CYBER ATTACKS AT THE HOST LEVFt . // 

3. A. 3. (U) END STATE// 

3. A. 3. A. (UZ/fB UO ) HRSS CAPABILITY IS FIELDED AND FULLY MISSION READY. 

3.A.3.S. lU/AFtHre-I ADVERSARIES ARE DETERRED FROM ATTACKING OP EXPLOITING THE 
DOD GIG. 

3.A.3.C. fU//fW| THE DOD GIG IS PERSISTENTLY SECURED AND DEFENDED USING 
HBSS AS A KEY ELEMFNT OF LAYERED, INTEGRATED DEFENSIVE CYBER OPFRATIOHS. 

3.B. (U) CONCEPT OF OPERATIONS. SEE ANNEX C FOR DETAILED DESCRIPTION. 

3.C. (U) TASKS 

3.C.I. (U) TASKS TO CC/S/A/FA 

3.C...A. CJ//-FW©) DEPLOY HBSS AGENT AMD MODULES TO ALL COMPATIBLE SYSTEMS 

AND NETWORKS IAW ANNEX C, APPENDIX 1 AND 2, IN ORDER TO DENY AND DETER 
ADVERSARIAL ACTION ON THE DOD GIG. SYSTEM COMPATIBILITY IS DETERMINED BY THE 
OPERATING SYS'IEM. A LINK TO THE “HBSS COMPATIBILITY MATRIX" IS PROVIDED AT 
( RF.F D) UNDER THE TTP SUBPAGE. 

3.C.I.B. ! U/ / fOG Q-j REPORT ASSFT DATA TO THE TIER ONE (ENTERPRISE) SERVER IAN 

ANNEX C, APPENDIX 1 IN ORDER TO PROVIDE INDICATIONS AND WARNING DATA FOR 
FURTHER ANALYSIS FROM TIER THREE (LOCAL) TO TIER ONE (ENTERPRISE). 

3.C.I.C. (U//-F 0U9 ; PROVIDE AND MAINTAIN EVENT DATA FEEDS TO THE TIER ONE 
(ENTERPRISE) SECURITY INFORMATION AND EVENT MANAGER (SIEK) TAW ANNEX C, 
APPENDIX 1 AND 2, IN ORDER TO PROVIDE I SW FOR DEFENSIVE CYBER OPERATIONS AND 
SIT’JAT 10NAI AWARENESS FROM TIER THREE (LOCAL! TO TIER ONE (ENTERPRISE). 

3.C.I.D. (U// FO : JO i REPORT EVENTS INDICATING AN IMMINENT THREAT TO THE GIG OR 
SIGNIFICANT DEGRADATION OF THE DEFENSIVE POSTURE OF THE GIG IAW ANNEX C, 
APPENDIX 3, IN ORDER TO MAINTAIN SITUATIONAL AWARENESS FROM TIER THRSF. 

(LOCAL) TO TIER ONE (ENTERPRISE). 

3.C.I.E. (U//-=990: REPORT DEPLOYMENT AND COMPLIANCE IAW ANNEX C, APPENDIX I, 

IN ORDER TO PROVIDE SITUATIONAL AWARENESS ON THE DEFENSIVE POSTURE OF THE DOD 
GIG. 

s.c.i.F. (U//rewe> provide contact information for all tier two icc/s/a/fa; 

PERSONNEL RESPONSIBLE FOR AIL ASPECTS CF HBSS ON A QUARTERLY BASIS IAW 
FORMATS 

SPECI PIED AT !REF D; IN ORDER TO ENHANCE EFPF.CTIVE COMMAND AMD CONTROL OF 
H3SS . 




4. A. fJ// fOUO - ; HBSS OPF.RAT I ONE SECURITY iCPSEC-. H3SS HAS BEEN LEPLOYED 
ACROSS THE GIG tAW "HE COMMERCIAL VENDOR INSTALLATION INSTRUCTIONS. HBSS 
PROVIDES A VALUABLE SECURITY AND ANALYSIS TOOL CRITICAL BOTH TO THE 
OPERATIONAL COMMANDER AND THE PROTECTION OF INFORMATION ACROSS THE GIG. 

WH.LE INITIAL COMMERCIAL CONFIGURATIONS AND CAPARII TTIFS OF HBSS ARE 
AVAILABLE ON THE INTERNET, DOD SPECIFIC CONFIGURATIONS, POLICIES, 

REQUIREMENTS, AND CAPABILITIES MUST 35 PROTECTED. ALL DOD SPECIFIC 
UNCLASSIFIED :B5S MITIGATIONS, CONFIGURATIONS, MODULES AND REQUIREMENTS WILL 
BE PROTECTED FROM INADVERTENT DISCLOSURE OUTSIDE THE DOD AND ENCRYPTED WHEN 
TRANSFERRED OVER ANY UNCLASSIFIED NETWORK. ALL DOD SPECIFIC HBSS THRESHOLDS 
ARE CLASSIFIED SECRET R5L FVFY TAW {REF K) AND MUST BE PROTECTED AS SUCH. 
CLASSIFIED INFORMATION MUST BF TRANSMITTED ON THE APPROPRIATE NETWORKS OR 
COMMUNICATION DEVICES.// 

GENTSXT/COMMAND AND SIGNAL/ 5. 

5 . ( r J ) COMMAND AMD SIGNAL 

b.A. (U//-Fet») DIRECT ALL TECHNICAL IMPLEMENTATION QUESTIONS TO YOUR LOCAL 
INFORMATION ASSURANCE MANAGER 1 1 AM OR CNDSP. FOR QUESTIONS MOT ADDRESSED BY 
YOUR LOCAL I AM OR CNDSP, TECHNICAL REFERENCES ARE AVAILABLE AT (KEF U> , AND 
FURTHER ASSISTANCE CAN BE OBTAINED FROM THE DI5A CUSTOMER SUPPORT DESK. 

5. B. (U// FOUO ) DIRECT ALL HBSS OPERATIONAL QUESTIONS TO: 

JOINT OPERATIONS CENTER (JOC, HBSS ANALYST 

COMM: 44 3-654-3977 
NST3 : 969-1473 

NIPR: ..U4 LPIjH-LOS • - ' L‘4 . t ' ■ L 
SI PR: J3 * EI-'I IK TO O ' : a:r 1 . . T ~ 1 . . i-L i 

5.C. {U// -FOUO ) ACKNOWLEDGEMENT. ALL DOD CC/S/A/FA WILL ACKNOWLEDGE RECEIPT 
OF THIS ORDER WITHIN 48 HOURS BY SENDING E-MAILS TO 30TH: 

JOC DYNAMIC NETWORK DEFENSE OFFICER IDNDO) 

COMM: 443-654-3972 

NSTS : 969-1494 

NIPR: [’ ■- i .=■ ■-. H.‘ 

ST PR: rr ~ WATCHijCYD lr ' M. ~ L.MI 1 

JOC DUTY OFFTCF.R !JDO) 

COMM: 443-654-3951 

NSTS: 966-8730 

NIPR: JOCvISV.'YBEr.’.’LI-'.M. ■ 

S I PR : IOCOPji? IY3IP "CM . S i I.. 1. 

GSNTEXT/ AUTHOR £ ZAT I ON / FOR THE COMMANDER, BRETT T. WILLIAMS, MAJOR GENERAL, US 
AIR FORCE, UNITED STATES CY3EH COMMAND DIRECTOR OF OPERATIONS, J3 . / / 
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